core-jmp

PPLControlShells — Protected Process / PPL Control shells Tool

February 9, 2026

by oxfemale AV BYOVD cpp EDR kernel Privilege Protection windows

PPLControlShells (the ppexec console tool) is a native Windows PP/PPL experimentation and control utility (x64)designed to help researchers understand, test, and demonstrate how Protected Process (PP) and Protected Process Light (PPL) behave on modern Windows (10/11 + compatible Server builds).

AV EDR Killer Project

February 2, 2026

by oxfemale AV BYOVD cpp EDR PPL windows

av-edr-kill is a BYOVD (Bring Your Own Vulnerable Driver) proof-of-concept whose goal is to terminate security-product processes (AV/EDR), including Protected Process Light (PPL) targets, by abusing a legitimately signed third-party kernel driver.

Exploring Protected Process Light and Exploits

February 2, 2026

by oxfemale cpp Injection Library PPL Uncategorized winapi winapi windows

Red team technique—process injection—and how to leverage it against Protected Process Light (PPL)

core-jmp

Posts tagged: PPL

PPLControlShells — Protected Process / PPL Control shells Tool

AV EDR Killer Project

Exploring Protected Process Light and Exploits

Recent Posts

Recent Comments

Archives

Categories